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Abstract 

It is noted that an efficient algorithm for calculating a p-adic height 
could have cryptanalytic applications. 

Elliptic curves and their generalizations are an active research topic with 
practical applications in cryptography Q, m, If E is an elliptic curve 
defined over a finite field Fp, where p is prime, and if P and Q are points 
on the curve E such that Q = nP, then the elliptic curve discrete logarithm 
problem (ECDLP) is to find n given P and Q on E. The essential difficulty 
of the ECDLP arises from the curves being defined over finite fields and 
the addition law having a complicated nonlinear structure. Philosophically 
several papers have been written where efficient algorithms have been devel¬ 
oped by taking advantage of the fact that finite fields sit very comfortably 
inside the p-adic fields. More precisely, objects defined over finite fields can 
be lifted to objects over p-adic fields using a simple or sophisticated versions 
of the Hensel’s lemma m, u Conversely, a p-adic object can be truncated 
to give an object in a finite field. Efficient algorithms using p-adic techniques 
include the attack on anomalous curves 0,0 and |Hj, p-adic point counting 
0, m, constructing elliptic curves with the required number of points HH 
etc. 

In this short note, we wish to bring to the attention of the cryptographic 
community some recent developments in the p-adic height function 
M which could be of cryptanalytic interest. 
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Several years ago Abramov and Rosenbloom (unpublished handwritten 
manuscript) had developed a mod p version of the a- function and used it to 
dehne a mod p height. See Introduction to the paper m and the references 
therein. In nn], they have dehned a p-adic u-function Up and a p-adic height 
function hp. The signihcance of this height function is that it is quadratic 
(that is, hp{nP) = n‘^hp{P)), unlike the local height which does not have 
this nice property. If a point on an elliptic curve has coordinates in the form 

(iF’ if )’hp i® dehned as — logp transformation properties 

of fjp and d are used to kill inconvenient terms in the local height so that hp 
becomes quadratic. As a comment on the side, we wish to point out that in 
Lenstra’s elliptic curve factorization algorithm m, [n, the denominator 
plays a key role. 

Koblitz in m states that the height function protects the elliptic curve 
cryptosystem, the reason being essentially that rational points with very 
large number of digits would be required in any attack. This is true if one 
lifts to Q but as is now folklore, the natural structure to lift to is not Q, 
but the p-adic held Qp, from hnite helds. For example, in Smart’s attack 
on anomalous curves jS], it is sufficient to take a p-fold sum and calculate 
modulo p^. The same is true of various p-adic algorithms. 

Recently an efficient algorithm for computing the p-adic height has been 
invented by Mazur, Stein and Tate m- This could possibly be used to 
develop an efficient algorithm to break cryptosystem based on elliptic curves. 

Finally, we wish to make some historical comments. Elliptic curves over 
rationals E{Q) have been traditionally studied because of interest in Dio- 
phantine equations and local heights studied as global heights were broken 
into local ones. In cryptography, as we begin with E{Fp), the natural ob¬ 
ject to study becomes E{Qp). Note that the p-adic height hp is a mapping 
from E{Q) fi Ei^p —> pZp, where Ei^p consists of points in E{Qp) with Lutz 
hltration > 1 and this was developed in the context of the mod p variant of 
the Birch-Swinnerton-Dyer conjecture HE]. 
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